An overview of the categories of Data Subjects, types of Customer Personal Databeing Processed and the nature and purpose of the Processing is provided inAppendix 1. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data under EU Data Protection Law and this DPA, Customer isthe Controller and Intrro is the Processor. Each Party will comply with its respectiveobligations under EU Data Protection Law with respect to the Processing of Customer Personal Data.

By entering into this DPA, Customer instructs Intrro to Process Customer Personal Data: (a) to provide the Services in accordance with the features and functionality ofthe Services and related documentation; (b) to enable Customer’s authorizeduser-initiated actions on and through the Services; (c) as set forth in the Agreement and applicable Orders; and (d) as further documented by written instructions given byCustomer. Notwithstanding the foregoing, Intrro will inform Customer promptly if itbecomes aware that Customer’s instructions may violate applicable EU Data Protection Law.